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Foreword 



id , 



This Technical Specification (TS) has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

x the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 
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Scope 



The present document specifies the stage 2 of the LoCation Services (LCS) feature in UMTS, which provides the 
mechanisms to support mobile location services for operators, subscribers and third party service providers. 

Location Services may be considered as a network provided enabling technology consisting of standardised service 
capabilities, which enable the provision of location applications. The application(s) maybe service provider specific. 
The description of the numerous and varied possible location applications which are enabled by this technology are 
outside the scope of the present document. However, clarifying examples of how the functionality being described may 
be used to provide specific location services may be included. 

This stage 2 service description covers the LCS system functional model for the whole system, the LCS system 
architecture, state descriptions, message flows, etc. 



References 



The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 



• 



References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

2.1 Normative references 

[I] 3G TR 25.305: "Functional stage 2 specification of location services in UTRAN". 
[2] GSM 01.04 (ETR 350): "Abbreviations and acronyms". 

[3] 3G TS 21.905: "UMTS Abbreviations and acronyms". 

[4] 3G TS 22.07 1 : "Location Services (LCS); Service description, Stage 1 " . 

[5] GSM 03.71: "Location Services (LCS); (Functional description) - Stage 2". 

[6] GSM 03.32: "Universal Geographical Area Description". 

[7] 3G TS 22.100: "UMTS phase 1 Release 99". 

[8] 3G TS 22.101: "Service principles". 

[9] 3G TS 22. 105: "Services and Service Capabilities". 

[10] 3G TS 22.115: "Charging and Billing". 

[II] 3G TS 22. 12 1 : "The Virtual Home Environment" . 

[12] 3G TS 23.1 10: "UMTS Access Stratum; Services and Functions". 

[13] PD 30.1cs: "Project Plan for location services in UMTS". 

[14] 3G TS 25.413: "UTRAN Iu Interface RANAP signalling". 

[15] 3G TS 23.060: "General Packet Radio Service (GPRS); Service description; Stage 2". 
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2.2 Informative references 

[16] Third generation (3G) mobile communication system; Technical study report on the location 

services and technologies, ARIB ST9 December 1998. 

[17] The North American Interest Group of the GSM MoU ASSOCIATION: Location Based Services, 

Service Requirements Document of the Services Working Group. 



3 Definitions and abbreviations 

3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply: 

CAMEL: CAMEL is a network functionality, which provides the mechanisms of Intelligent Network to a mobile user 

Current Location: after a location attempt has successfully delivered a location estimate and its associated time stamp, 
the location estimate and time stamp is referred to as the "current location" at that point in time 

Deferred location request: a location request where the location response (responses) is (are) not required immediately 

Global Positioning System: the Global Positioning System (GPS) consists of three functional elements: Space 
Segment (satellites), User Segment (receivers), and Control Segment (maintenance etc.). The GPS receiver calculates 
its own position based on the received time differences for several satellites 

Immediate location request: a location request where a single location response only is required immediately 

Initial Location: in the context of an originating emergency call the location estimate and the associated time stamp at 
the commencement of the call set-up is referred to as "initial location" 

Last Known Location: the current location estimate and its associated time stamp for Target UE stored in the LCS 
Server is referred to as the "last known location" and until replaced by a later location estimate and a new time stamp is 
referred to as the "last known location" 

LCS (LoCation Services): LCS is a service concept in system (e.g. GSM or UMTS) standardization. LCS specifies all 
the necessary network elements and entities, their functionalities, interfaces, as well as communication messages, due to 
implement the positioning functionality in a cellular network. Note that LCS does not specify any location based (value 
added) services except locating of emergency calls 

LCS Client: a software and/or hardware entity that interacts with a LCS Server for the purpose of obtaining location 
information for one or more Mobile Stations. LCS Clients subscribe to LCS in order to obtain location information. 
LCS Clients may or may not interact with human users. The LCS Client is responsible for formatting and presenting 
data and managing the user interface (dialogue). The LCS Client may reside in the Mobile Station (UE) 

LCS Client Access barring list: an optional list of MSISDNs per LCS Client where the LCS Client is not allowed to 
locate any MSISDN therein 

LCS Client Subscription Profile: a collection of subscription attributes of LCS related parameters that have been 
agreed for a contractual period of time between the LCS client and the service provider. 

LCS Feature: the capability of a PLMN to support LCS Client/server interactions for locating Target UEs 

LCS Server: a software and/or hardware entity offering LCS capabilities. The LCS Server accepts requests, services 
requests, and sends back responses to the received requests. The LCS server consists of LCS components, which are 
distributed to one or more PLMN and/or service provider 

Local Service: a service, which can be exclusively provided in the current serving network by a Value added Service 
Provider 
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Local Information: information related to a given location, or general information, which is made available in a given 
location 

Location (Based) Application: a location application is an application software processing location information or 
utilizing it in some way. The location information can be input by a user or detected by network or UE. Navigation is 
one location application example 

Location Based Service (LBS): a service provided either by teleoperator or a 3 rd party service provider that utilizes the 
available location information of the terminal. Location Application offers the User Interface for the service. LBS is 
either a pull or a push type of service (see Location Dependent Services and Location Independent Services). In 
ETSI/GSM documentation of SoLSA, LBS is called "Location Related Service". ETSI and/or 3GPP -wide terminology 
harmonization is expected here 

Location Dependent Service: a service provided either by teleoperator or a 3 ld party service provider that is available 
(pull type) or is activated (push type) when the user arrives to a certain area. It doesn't require any subscription in 
advance, but the push type activation shall be confirmed by the user. The offered service itself can be any kind of 
service (e.g. a public Xerox machine or the discount list in a store) 

Location Estimate: the geographic location of an UE and/or a valid Mobile Equipment (ME), expressed in latitude and 
longitude data. The Location Estimate shall be represented in a well-defined universal format. Translation from this 
universal format to another geographic location system may be supported, although the details are considered outside 
the scope of the primitive services 

Location Independent Service: a service provided either by teleoperator or a 3 ld party service provider that is available 
and therefore can be activated anywhere in the network coverage. It is activated by the user's request or by other user's 
activated service, and therefore it requires a subscription in advance (pull type). The offered service itself can be any 
kind of service (e.g. MMS, SWDL, or LBS!) 

Mobile Assisted positioning: any mobile centric positioning method (e.g. E-OTD, GPS) in which the UE provides 
position measurements to the network for computation of a location estimate by the network. The network may provide 
assistance data to the UE to enable position measurements and/or improve measurement performance 

Mobile Based positioning: any mobile centric positioning method (e.g. E-OTD, GPS) in which the UE performs both 
position measurements and computation of a location estimate and where assistance data useful or essential to one or 
both of these functions is provided to the UE by the network. Position methods where an UE performs measurements 
and location computation without network assistance data are not considered within this category 

Mobile Station: the mobile station (UE) consists of Mobile or User Equipment (ME or UE) with a valid SIM or USIM 
attached 

PLMN Access barring list: an optional list of MSISDN per PLMN where any LCS Client is not allowed to locate any 
MSISDN therein except for certain exceptional cases 

Positioning (/location detecting): positioning is a functionality, which detects a geographical location (of e.g. a mobile 
terminal) 

Positioning method (/locating method): a principle and/or algorithm which the estimation of geographical location is 
based on, e.g. AOA, TOA, TDOA. For example, GPS is based on TOA, and E-OTD (on GSM) is based on TDOA 

Positioning technology (/locating technology): a technology or system concept including the specifications of RF 
interfaces, data types, etc. to process the estimation of a geographical location, e.g. GPS, E-OTD (GSM), and IPDL- 
TDOA(WCDMA) 

Predefined area: a geographical area which is not related to cell or radio coverage. The mobile may take special action 
when it recognises it has entered or left a predefined area 

Privacy Class: list of LCS Clients defined within a privacy exception class to which permission may be granted to 
locate the target UE. The permission shall be granted either on activation by the target UE or permanently for a 
contractual period of time agreed between the target UE and the service provider 

Privacy Exception List: a list consisting of various types of privacy classes (i.e. operator related, personal etc.). 
Certain types of classes may require agreement between the service provider and the target UE 
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Prohibited area: an area where the mobile must not activate its transmitter. The Prohibited area may be a Predefined 
area described above or related to radio cell(s) 

Subscription Profile: the profile detailing the subscription to various types of privacy classes 

Target UE: the UE being positioned 

Further UMTS related definitions are given in 3G TS 22.101. 



3.2 Symbols 



For the purposes of the present document, the following symbols apply: 



Lc 
Le 
Lh 
Lg 
Lg' 
Uu 



Interface between gateway MLC and gsmSCF (CAMEL interface) 
Interface between External User and MLC (external interface) 
Interface between Gateway MLC and HLR (HLR interface) 
Interface between Gateway MLC and VMSC (gateway MLC interface) 
Interface between Gateway MLC and SGSN (gateway MLC interface) 
Air Interface to a stand-alone LMU (measurement interface) 



3.3 



Abbreviations 



For the purposes of the present document, the following abbreviations apply: 

3G-MSC 3 rd Generation MSC 

3G-SGSN 3 rd Generation SGSN 

AC Admission Control 

AI Application Interface (prefix to interface class method) 

ANM Answer Message (ISUP) 

ARIB Association of Radio Industries and Business 

ATD Absolute Time Difference 

BCCH Broadcast Control Channel 

BER Bit Error Rate 

BS Base Station 

BSS Base Station Subsystem 

CAMEL Customised Application For Mobile Network Enhanced Logic 

CAP CAMEL Application Part 

CM Connection Management 

CN Core Network 

CSE Camel Service Environment 

DL Downlink 

DRNC Drift RNC 

E-OTD Enhanced Observed Time Difference 

FER Frame Error Rate 

GGSN Gateway GPRS Support Node 

GMLC Gateway MLC 

GPRS General Packet Radio System 

GPS Global Positioning System 

HE Home Environment 

HLR Home Location Register 

HPLMN Home Public Land Mobile Network 

IMEI International Mobile Equipment Identity 

IUEI International Mobile Subscriber Station Identity 

IP Internet Protocol 

IPDL Idle Period Downlink 

LA Location Application 

LAF Location Application Function 

LBS Location Based Services 

LCAF Location Client Authorization Function 

LCCF Location Client Control Function 

LCCTF Location Client Co-ordinate Transformation Function 
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LCF Location Client Function 

LCS LoCation Services 

LDR Location Deferred Request 

LIR Location Immediate Request, 

LMU Location Measurement Unit 

LSAF Location Subscriber Authorization Function 

LSBF Location System Billing Function 

LSBcF Location System Broadcast Function 

LSCF Location System Control Function 

LSOF Location System Operation Function 

LSPF Location Subscriber Privacy Function 

MAP Mobile Application Part 

ME Mobile Equipment 

MExE Mobile Station (Application) Execution Environment 

MLC Mobile Location Center 

MM Mobility Management 

MO-LR Mobile Originated Location Request 

UE Mobile Station 

MSC Mobile services Switching Centre 

MSISDN Mobile Station Integrated Services Data Network 

MT-LR Mobile Terminated Location Request 

NI-LR Network Induced Location Request 

OSA Open Service Architecture 

OTDOA Observed Time Difference Of Arrival 

PC Power Control 

PCF Power Calculation Function 

PLMN Public Land Mobile Network 

PRCF Positioning Radio Co-ordination Function 

PRRM Positioning Radio Resource Management 

PSE Personal Service Environment 

PSMF Positioning Signal Measurement Function 

PSTN Public Switched Telephone Network 

QoS Quality of Service 

RA Routing Area 

RACH Random Access Channel 

RAN Radio Access Network 

RANAP Radio Access Network Application Part 

RIS Radio Interface Synchronization 

RNC Radio Network Controller 

RRM Radio Resource Management 

RTD Real Time Difference 

SAT SIM Application Tool-Kit 

SGSN Serving GPRS Support Node 

SI Service Interface (prefix to interface class method) 

SIM Subscriber Identity Module 

SMS Short Message Service 

SIR Signal Interference Ratio 

SP Service Point 

SRNC Serving RNC 

SS7 Signalling System No 7 

TA Timing Advance 

TMSI Temporary Mobile Subscriber Identity 

TOA Time Of Arrival 

U- UMTS-(LCS functional block) 

UDT SCCP Unitdata message 

UE User Equipment 

UL Uplink 

UMTS Universal Mobile Telecommunication System 

USIM User Service Identity Module 

UTRAN Universal Terrestrial Radio Access Network 

VASP Value Added Service Provider 

VHE Virtual Home Environment 
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WCDMA Wideband Code Division Multiple Access 

Further GSM related abbreviations are given in GSM 01.04. Further UMTS related abbreviations are given in UMTS 
TS 22.101. 



Main concepts 



A general description of location services and service requirements are given in the specification 3G TS 22.071 [4]. The 
positioning of the UE is a service provided by the UMTS Access Stratum. In particular, all Access Networks (e.g. 
UTRAN, GSM BSS), that facilitate determination of the locations of User Equipments, shall be able to exchange 
location information with the UMTS core network as defined in the present document (when connected to a UMTS 
Core Network). 

By making use of the radio signals the capability to determine the (geographic) location of the user equipment (UE) 
mobile station shall be provided. The location information may be requested by and reported to a client (application) 
associated with the UE, or by a client within or attached to the Core Network. The location information may also be 
utilised internally by UMTS; for example, for location assisted handover or to support other features such as home 
location billing. The position information shall be reported in standard, i.e. geographical co-ordinates, together with the 
time-of-day and the estimated errors (uncertainty) of the location of the UE. 

It shall be possible for the majority of the UE (active or idle) within a network to use the feature without compromising 
the radio transmission or signalling capabilities of the UMTS. 

The uncertainty of the location measurement shall be network design (implementation) dependent at the choice of the 
network operator, this is further described in TS 25.305. 

There are many different possible uses for the location information. The positioning feature may be used internally by 
the UMTS network (or attached networks), by value-added network services, by the UE itself or through the network, 
and by "third party" services. The positioning feature may also be used by an emergency service (which may be 
mandated or "value-added"), but the position service is not exclusively for emergencies. 

4.1 Location services in UMTS Release 1999 

It should be noted that UMTS Release 99 supports only cell coverage based LCS in the circuit switched domain. In 
addition UMTS Release 99 also contains LCS "hooks" for compatibility with future releases. 

These "hooks" in UTRAN are descriptions of the positioning methods OTDOA-IPDL (observed time difference of 
arrival with network adjustable idle periods) and assisted GPS methods that are specified in the UTRAN Stage 2 
specification 25.305 and in the present document 23.171 from system point of view. 

LCS support in the packet switched domain is regarded as LCS Core Network "hooks", which in R99 are defined only 
in the present document 23.171. 

4.2 Assumptions 

As a basis for the development work on LCS in UMTS the following assumptions apply: 

• Positioning methods are Access Network specific, although commonalties should be encouraged between Access 
Networks. 

• Commercial location services are only applicable for an UE with a valid SIM or USIM. 

• The provision of the location services in the Access Network is optional through support of the specified 
method(s). 

• The provision of location services is optional in 3G-MSC and 3G-SGSN. 

• LCS is applicable to any target UE whether or not the UE supports LCS, but with restrictions on choice of 
positioning method or notification of a location request to the UE user when LCS or individual positioning 
methods, respectively, are not supported by the UE. 
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• 



• 



LCS shall be applicable for circuit switched services. 

The location information may be used for internal system operations to improve system performance. 

It shall be possible to accommodate future techniques of measurement and processing to take advantage of 
advancing technology so as to meet new service requirements. 

Iur shall be used for LCS signalling, even in the case when the RNSs are connected to different 3G-MSCs or 3G- 
SGSNs. 



4.3 Location Services Categories 



Generally there are four categories of usage of the location service. These are the Commercial LCS, the Internal LCS, 
the Emergency LCS and the Lawful Intercept LCS. The definition of these services and their categories is outside the 
scope of the present document. 

• The Commercial LCS (or Value Added Services) will typically be associated with an application that provides 
a value-added service through knowledge of the UE location to the subscriber of the service. This may be, for 
example, a directory of restaurants in the local area of the UE, together with directions for reaching them from 
the current UE location. 

• The Internal LCS will typically be developed to make use of the location information of the UE for Access 
Network internal operations. This may include; for example, location assisted handover and traffic and coverage 
measurement. This may also include support certain O&M related tasks, supplementary services, IN related 
services and GSM bearer services and teleservices. 

• The Emergency LCS will typically be part of a service provided to assist subscribers who place emergency 
calls. In this service, the location of the UE caller is provided to the emergency service provider to assist them in 
their response. This service may be mandatory in some jurisdictions. In the United States, for example, this 
service is mandated for all mobile voice subscribers. 

• The Lawful Intercept LCS will use the location information to support various legally required or sanctioned 

services. 



4.4 Positioning methods 



The LCS feature utilises one or more positioning methods in order to determine the location of user equipment (UE). 
Determining the position of a UE involves two main steps: 

• Radio signal measurements; and 

• Position estimate computation based on the measurements. 
The positioning methods for UTRAN are further described in [0]. 

4.4.1 Standard LCS Methods in UTRAN Release 99 

The specification 25.305 UTRAN Stage 2 specifies the locating method to be supported in Release 99: 

• Cell coverage based positioning method. 

The following locating methods are described in 25.305, but will be fully specified in Release 2000: 

• OTDOA positioning method; 

• Network assisted GPS positioning methods. 

For more details on these positioning methods, refer to [1]. 
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4.5 Location information sources, network interaction 

The location service design should not be limited to a single technique or source of information. As operating 
conditions vary both within and between networks, the LCS design should be able to make use of as many 
measurements and techniques as are available and are appropriate for the needs of (and the cost of) the service being 
provided. 

The location process shall include the option to include all of the available UTRAN signals, including those from other 
networks with coverage available to the UE. While it should not be necessary for the UE to access these other networks, 
the UE and the location process should be able to make use of the signals from these sources in addition to those of the 
serving network. It should be noted that the UE does not need to access a foreign network in order to make 
measurements of the downlink signals. 

It is critical to positioning accuracy that as many measurements are used as possible. This is particularly important in 
regions where the serving operator may provide coverage with only a single base station. Typically there will be 
additional coverage of these regions by other operators, but perhaps only from one base station from each operator. By 
making measurements of the signals from several operators the UE will typically be able to obtain information to make 
a better location estimate than would be possible with just the signals from a single operator (assuming that the base 
stations are not collocated). The use of signals and other information from several operators would, of course, be subject 
to suitable operator agreement. 

In some cases the UE may be able to operate in other modes (e.g. GSM) for which a location service feature is also 
provided. The signals of the other mode and location information may be helpful to the UMTS LCS. For example, 
measurements of the GSM signals may be used by the UTRAN LCS calculation function to supplement the UTRAN 
radio measurements. The use of this information would, of course, be subject to suitable operator agreements. The 
techniques for this inter-mode operation and any signalling between networks are FFS. 

The LCS information sources and the signalling required for their interaction, are FFS. 



5 General LCS architecture 

5.1 LCS access interfaces and reference points 

There is one reference point between the LCS server and LCS client called Le, see Figure 5.1. Le is described in 
TS 22.071 [4], however the protocol specifics are for further study. There may be more than a single LCS network 
interface to several different LCS clients or other networks. These networks may both differ in ownership as well as in 
communications protocol. The network operator should define and negotiate interconnect with each external LCS client 
or other network. 

An interface differs from a reference point in that an interface is defined where specific LCS information is exchanges 
and needs to be fully recognized. 

There is an interface called Lg that connects two independent LCS networks (different PLMNs) for message exchange. 




Figure 5.1 : LCS Access Interfaces and Reference Points 
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5.2 LCS Functional diagram, high level functions 

TS 22.071 [4] describes LCS services from the LCS client point of view. In the present document, a more detailed 
description of LCS is given. The LCS functional diagram shown in Figure 5.2 depicts the interaction of the LCS client 
and the LCS server within the PLMN. The PLMN uses the various LCS components within the LCS server to provide 
the target UE Location Information to the LCS client. 
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Figure 5.2: UMTS LCS capability server Functional Diagram 

The following list gives the logical functional entities for the LCS. Two main functional groupings are defined which 
encompass a number of smaller functions. 

The LCS Functional entities are grouped as follows: 
The LCS Client functional group. 

The LCS Server functional group consists of functions in the UMTS PLMN supporting LCS: 

Client handling component; 

System handling component; 

Subscriber handling Component; 

Positioning component. 
The functions of the LCS Client and the LCS Server in UMTS PLMN are described in more detail in this subclause. 
The allocation of LCS functions to UMTS network elements is specified in clause 6. 
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5.3 LCS Client functional group 



An LCS client contains an LCS component with one or more client(s), which by using location information can provide 
location, based services. 

An LCS client is a logical functional entity that requests from the LCS server in the PLMN location information for one 
or more than one target UE within a specified set of parameters such as Quality of Service (QoS). The LCS Client may 
reside in an entity (including the UE) within the PLMN or in an entity external to the PLMN. 

The specification of the LCS Client's internal logic and its relation to the external use is outside the scope of the present 
document. 

5.3.1 External Location Client Function (LCF) 

The Location Client Function (LCF) provides a logical interface between the LCS client and the LCS server. 

This function is responsible for requesting location information for one or more MEs/UEs, with a specified "QoS" and 
receiving a response, which contains either location information or a failure indicator. 

[Editor's note: this is only possible if the location request originates in the core network] 

5.3.2 Internal Location Client Function (U-LCF) 

The Location Client Function (LCF) provides a logical interface between the internal ACCESS NETWORK LCS 
applications and the ACCESS NETWORK LCS system handling entities (e.g. the Location System Control Function 
(U-LSCF) in the ACCESS NETWORK). This interface may be internal to one network element. 

The ACCESS NETWORK may make use of location information for internal operations such as location assisted 
handover. In such a case, a U-LCF representing the internal ACCESS NETWORK LCS application may communicate 
with the U-LSCF to request and receive the location information. 

For UTRAN, this interface is further described in [1]. 

5.4 LCS Server functional group in UMTS 

The LCS server functional group consists of the UMTS functions that are needed for UMTS to support Location 
Services. 

5.4.1 Client handling component 

5.4.1 .1 Location Client Control Function (LCCF) 

The Location Client Control Function (LCCF) manages the external interface towards LCF. The LCCF identifies the 
LCS client by requesting client verification and authorization ( i.e. verifies that the LCS client is allowed to position the 
subscriber) through interaction with the Location Client Authorization Function (LCAF). The LCCF handles mobility 
management for location services (LCS) e.g., forwarding of positioning requests to 3G-VMSC. The LCCF determines if 
the final positioning estimate satisfies the QoS for the purpose of re try /reject. The LCCF provides flow control of 
positioning requests between simultaneous positioning requests. It may order the Location Client Co-ordinate 
Transformation Function (LCCTF) to perform a transformation to local co-ordinates. It also generates charging and 
billing related data for LCS via the Location System Billing Function (LSBF). 

5.4.1 .2 Location Client Authorization Function (LCAF) 

The Location Client Authorization Function (LCAF) is responsible for providing access and subscription authorization 
to a client. Specifically, it provides authorization to a LCS client requesting access to the network and authorizes the 
subscription of a client. LCAF provides authorization to a LCS client requesting Location Information of a specific UE. 
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5.4.1.2.1 Access Subfunction 

An Access Subfunction enables LCS clients to access LCS services. This subfunction provides verification and 
authorization of the requesting client. 

When a LCS is requested, the Access Subfunction uses the information stored in the LCS client subscription profile to 
verify that: 

the LCS client is registered; and 

the LCS client is authorized to use the specified LCS request type; 

the LCS client is allowed to request location information for the subscriber(s) specified in the LCS request. 

5.4.1.2.2 Subscription Subfunction 

The LCS client Subscription profile shall contain a minimum set of parameters assigned on per LCS client basis for an 
agreed contractual period. The LCS client profile shall contain the following set of access parameters: 

LCS client identity; 

Allowed LCS request types (i.e. LIR, LDR or both); (see note) 

Maximum number of subscribers allowed in a single LCS request; 

Priority; 

Position override indicator; 
- State(s); 

Event(s) (applicable to LDR requests only); 

Local coordinate system; 

LCS client access barring list (optional); 

PLMN access barring list applicability; 

NOTE: LIR = Location Immediate Request; and LDR = Location Deferred Request. 

For certain authorized LCS client internal to the PLMN, a subscription profile is unnecessary. These clients are 
empowered to access any defined service that is not barred for an UE subscriber. This permits positioning of emergency 
calls without the need for pre-subscription. 

5.4.1 .3 Location Client Co-ordinate Transformation Function (LCCTF) 

The Location Client Co-ordinate Transformation Function (LCCTF) provides conversion of a location estimate 
expressed according to a universal latitude and longitude system into an estimate expressed according to a local 
geographic system understood by the LCF and known as location information. The local system required for a 
particular LCF will be either known from subscription information or explicitly indicated by the LCF. 

5.4.2 System handling component 

5.4.2.1 Location System Control Function in general (LSCF) 

The Location System Control Function (LSCF) is responsible for co-ordinating location requests. This function 
manages call-related and non-call-related positioning requests of LCS and allocates network resources for handling 
them. The LSCF retrieves UE classmark for the purpose of determining a positioning method. The LSCF performs call 
setup if required as part of a LCS e.g., putting the ME on dedicated radio resources. It also caters for co-ordinating 
resources and activities with regard to requests related to providing assistance data needed for positioning. This function 
interfaces with the LCCF, LSPF, LSBF and PRCF. Using these interfaces, it conveys positioning requests to the PRCF, 
relays positioning data to the LCCF and passes charging related data to the LSBF. 
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5.4.2.2 Access Network Location System Control Function(U-LSCF) 

The Access Network Location System Control Function is responsible for co-ordinating location requests. This function 
manages call-related and non-call-related location requests and allocates network resources for handling them. This 
function "insulates" the Location clients in the Core Network from the detailed operation of the location method in 
order that the Access Network may be used by several types of core network and with several location methods. 

The U-LSCF for UTRAN is further described in [1]. 

5.4.2.3 Location System Billing Function (LSBF) 

The Location System Billing Function (LSBF) is responsible for charging and billing activity within the network related 
to location services (LCS). This includes charging and billing of both clients and subscribers. Specifically, it collects 
charging related data and data for accounting between PLMNs. 

5.4.2.4 Location System Operations Function (LSOF) 

The Location System Operations Function (LSOF) is responsible for provisioning of data, positioning capabilities, data 
related to clients and subscription (LCS client data and UE data), validation, fault management and performance 
management of UMTS LCS. 

An LSOF may be associated with each entity. 

[Editor's note: This is being studied in GSM. FFS in UMTS. Internal LCF may be part of O&M functions.] 

5.4.2.5 Location System Broadcast Function (LSBcF) 

The Location System Broadcast Function (LSBcF) provides broadcast capability. The LSBcF capability is only 
used when broadcast data is required for OTDOA or assisted GPS positioning methods. 

5.4.3 Subscriber handling Component 

5.4.3.1 Location Subscriber Authorization Function (LSAF) 

The Location Subscriber Authorization Function (LSAF) is responsible for authorizing the provision of a location 
service (LCS) for a particular mobile station (UE with SIM/USIM). Specifically, this function validates that a LCS can 
be applied to a given subscriber. In case LCF is in the UE then LSAF verifies that the UE subscriber has subscribed to 
the requested LCS service. 

5.4.3.2 Location Subscriber Privacy Function (LSPF) 

The Location Subscriber Privacy function is responsible performs all privacy related authorizations. For a target UE it 
shall authorize the positioning request versus the privacy options of the target UE, if any. 

5.4.4 Positioning components 

The positioning components UMTS Access Network - Positioning Radio Co-ordination Function (U-PRCF), UMTS 
ACCESS NETWORK Positioning Calculation Function (U-PCF), UMTS Access Network - Positioning Signal 
Measurement Function (U-PSMF) and UMTS Access Network - Positioning Radio Resource Management (U-PRRM) 
are described in documents specific to each Access Network type. 

For location services the Access Network shall send the result of the positioning to the core network in geographical co- 
ordinates as defined in TS 23.032. For UTRAN the SRNC shall map the cell(s) the Target UE is associated with into 
geographical co-ordinates, but this mapping is not standardized. 

These entities are defined for UTRAN in [1]. 
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5.5 Information Flows between Client and Server 

Other types of national specific information flows may be supported in addition to the information flow specified here. 

Any of the information flows here indicated may not be externally realized if the information does not flow over an 
open interface. On the other hand, if a flow goes over an open interface, it shall abide to a well-defined protocol, which 
will be further specified in other relevant specifications. 

5.5.1 Location Service Request 

Via the Location Service Request, the LCS client communicates with the LCS server to request for the location 
information of one or more than one UE within a specified quality of service. There exist two types of location service 
requests: 

Location Immediate Request (LIR); and 

Location Deferred Request (LDR). 

The attributes for the information exchange between the LCS Client and the LCS Server have not been standardized for 
GSM. This information exchange may be standardized in later releases. 

The following generic attributes are identified for Location Service Request information flow: 

Target UE identity; 

- LCS Client identity; 

Number dialled by the target mobile user if the request is call related; 

Requested Quality of Service information, if needed; 

Type of location, i.e. current location or last known location 

Priority, if needed 

Local coordinate reference system, if needed; 

Some of the information may be stored in GMLC and the LCS client does not need to include such information in 
the location service request. 

5.5.2 Location Service Response 

The LCS server (GMLC) sends the Location Service Response to the LCS client either as an: 

Immediate Response; or a 

Deferred Response, these deferred responses can be either single or periodic. 
The following generic attributes are identified for the Location Service Response information flow: 

Location indication of UE in geographical coordinates or local coordinate system; 
In addition the information attributes of the location service request may be used also in the location service response. 



UMTS LCS Architecture 



Figure 6.1 shows the general arrangement of the Location Service feature in UMTS. This illustrates, generally, the 
relation of LCS Clients and servers in the core network with the UMTS Access Network. The LCS entities within the 
Access Network communicate with the Core Network (CN) across the Iu interface. Communication among the Access 
Network LCS entities makes use of the messaging and signalling capabilities of the Access Network. 
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As part of their service or operation, the LCS Clients may request the location information of user equipment UE (UE 
without a valid SIM/USIM) or mobile stations. There may be more than one LCS client. These may be associated with 
the UMTS network or the Access Network operated as part of a UE application or accessed by the UE through its 
access to an application (e.g. through the Internet). 

The clients make their requests to a LCS Server. There may be more than one LCS Server. The client must be 
authenticated and the resources of the network must be co-ordinated including the UE and the calculation functions, to 
estimate the location of the UE and result returned to the client. As part of this process, information from other systems 
(other Access Networks) can be used. As part of the location information returned to the client, an estimate of the 
accuracy of the estimate and the time-of-day the measurement was made shall be provided. 
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Note 1): The usage of CBC for LCS assistance data in UMTS is for further study. The assistance data is generated 
in SRNC. 

Figure 6.1 : General arrangement of LCS in UMTS, UTRAN example 

6.1 Schematic functional description of LCS operations in 
UMTS 

The allocation of LCS functional blocks to the Client, LCS server, Core Network, Access Network and UE is based on 
the schematic functional description below. The detailed functions and interactions are specified later in the present 
document and in TS 25.305 and corresponding Stage 3 specifications. 

The operation begins with a LCS Client requesting location information for a UE from the LCS server. The LCS server 
will pass the request to the LCS functional entities in the UMTS core network. The LCS functional entities in the core 
network shall then: 

verify that the LCS Client is authorized to request the location of the UE or subscriber; 

verify that LCS is supported by the UE; 

establish whether it is allowed to locate the UE or subscriber, for privacy or other reasons; 

establish which Serving RNC should receive the Location request if necessary by establishing a connection with 
theUE; 
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request the Access Network (via the Iu interface) to provide location information for an identified UE, with 
indicated QoS; 

receive information about the location of the UE from the Access Network and forward it to the Client; 

send appropriate accounting information to an accounting function. 

The Access Network LCS functional entities shall typically: 

request measurements, typically from the UE and radio network apparatus; 

send the measurement results to the appropriate calculating function within the Access Network; 

receive the result from the calculating function within Access Network; 

indicate the geographical co-ordinates of the Target UE corresponding to the cell(s) the Target UE is associated 
with; 

perform any needed co-ordinate transformations; 

send the results to the LCS entities in the core network. 

In the event that the client is internal to the Access Network the request may be made directly to the Access Network 
LCS entities as the internal clients are considered to be "pre-authorised". 

As part of its operation, the calculating function may require additional information. This may be obtained by the 
function directly by communication with a database, or it may be through a request to LCS entities that will mediate the 
request and return of information from the appropriate database (or databases if more than one is needed to fulfil the 
requests). The LCS application may make use of the position information itself, or further process and then forward the 
information to other authorised applications within or external to the Access Network. 

There may possibly also be available independent information that is able to supply the location information directly, or 
may be able to supply auxiliary information to the calculation function. The LCS co-ordination function, as part of its 
activity to supervise the positioning process, may query the UE or other elements of the network to determine their 
capabilities and use this information to select the mode of operation. 

6.2 Allocation of LCS functions to UMTS network elements 

Table 6.1 shows a summary of the Functional Groups and Functional Blocks for Location services in UMTS. Table 6.2 
and Figure 6.2 show the generic configuration for LCS in UMTS and the distribution of LCS functional blocks to 
UMTS network elements. Different positioning methods, including network-based, mobile-based, mobile-assisted and 
network-assisted positioning methods may be used. With this configuration both the network and the mobiles are able 
to measure the timing of signals and compute the mobile's location estimate. Depending on the applied positioning 
method it is possible to utilise the corresponding configuration containing all needed entities. For instance, if network- 
based positioning is applied, the entities that are involved in measuring the mobile's signal and calculating its location 
estimate are allocated to the network elements of the access stratum. On the other hand, in case mobile-based or 
network-assisted methods are used these entities should be allocated to the mobile station. 

LCS is logically implemented on the UMTS structure through the addition of one network node, the Mobile Location 
Center (MLC). It is necessary to name a number of new interfaces. The LCS generic architecture can be combined to 
produce LCS architecture variants. 
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Table 6.1 : Summary of Functional Groups and Functional Blocks for Location services in UMTS 



Funct. 
Group 


Functional 
component 


Full name of Functional Block 


Abbrev. 


Loc. 
Client 


Location Client 
component 


(External) Location Client Function 


LCF 


Internal Location Client Function 


U-LCF 
-internal 














LCS 

Server in 

PLMN 


Client handling 
component 


Location Client Control Function 


LCCF 


Location Client Authorization Function 


LCAF 














System 

handling 

component 


Stand-alone LMU Mobility Management Function 


LMMF 


Location System Control Function 


LSCF 


Location System Control Function in RNC 


U-LSCF 


Location System Billing Function 


LSBF 


Location System Operations Function 


LSOF 








Subscr. 

handling 

component 


Location Subscriber Authorization Function 


LSAF 


Location Subscriber Privacy function 


LSPF 








Positioning 
component 


UMTS- Positioning Radio Control Function 


U-PRCF 


UMTS- Positioning Calculation Function 


U-PCF 


UMTS- Positioning Signal Measurement Function 


U-PSMF 


UMTS- Positioning Radio Resource Management 


U-PRRM 



Table 6.2 and Figure 6.2 illustrate the allocation of functional entities in the reference configuration of LCS in UMTS. 
It is assumed that the CS and PS have either their own independent mobility management or use the joint mobility 
management through the optional Gs interface. 

It is also seen that LCS in UMTS shall take benefit of the standardized Iur interface between RNSs, when uplink radio 
information and measurement results are collected. 

The functional model presented in the figure includes functional entities for CS related LCS. In addition, it consists of 
all the entities needed for different positioning methods, i.e. network based, mobile based, mobile assisted, and network 
assisted positioning, exploiting either uplink or downlink measurements. 
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Table 6.2: Allocation of LCS functional entities to network elements 
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Figure 6.2: Generic LCS Logical Architecture 
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6.3 Functional description of LCS per network element 

6.3.1 Access Network 

The Access Network is involved in the handling of various positioning procedures. 

Specific UTRAN functionality is specified in each of the positioning procedures sections in the UTRAN Stage 2, 
TS 25.305. 

6.3.2 LCS Clients and LCS applications 

There are two classes of LCS Application - Internal applications and External applications. Internal applications 
represent entities internal to the UMTS that make use of location information for the (improved) operation of the 
network. External applications represent entities (such as Commercial or Emergency services) that make use of location 
information for operations external to the mobile communications network. The LCS Applications interface to the LCS 
entities through their Location Client functions (LCF). 

The LCS Client and LCS applications are outside the scope of the present document. 

6.3.3 Gateway Mobile Location Center, GMLC 

The Gateway Mobile Location Center (GMLC) contains functionality required to support LCS. In one PLMN, there 
may be more than one GMLC. 

The GMLC is the first node an external LCS client accesses in a GSM PLMN (i.e. the Le reference point is supported 
by the GMLC). The GMLC may request routing information from the HLR via the Lh interface. After performing 
registration authorization, it sends positioning requests to and receives final location estimates from the 3G-VMSC via 
the Lg interface. 

6.3.4 Serving RNC, UTRAN case 

The Serving RNC (SRNC) is a network element of UTRAN and contains functionality required to support LCS in 
PLMN. The LCS functionality of SRNC is given in [1], 

6.3.5 (void) 

6.3.6 LMU 

The Location Measurement Unit LMU entity makes measurements (e.g. of radio signals) and communicates these 
measurements within the Access Network. The LMU is described in [1]. 

6.3.7 3G-MSC/VLR 

The 3G-MSC/VLR contains functionality responsible for UE subscription authorization and managing call-related and 
non-call related positioning requests of LCS. The 3G-MSC is accessible to the GMLC via the Lg interface. The LCS 
functions of 3G-MSC are related to charging and billing, LCS co-ordination, location request, authorization and 
operation of the LCS services. 

6.3.8 (void) 

6.3.9 Home Location Register, HLR 

The HLR contains LCS subscription data and routing information. The HLR is accessible from the GMLC via the Lh 
interface. For roaming UEs, HLR may be in a different PLMN than the current SRNC. 
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6.3.10 gsmSCF 

The Lc interface supports CAMEL access to LCS and is applicable only in CAMEL [phase 3?]. The procedures and 
signaling associated with it are defined in TS 23.078 and TS 29.002, respectively. 

6.4 Addressing the target UE for LCS purposes 

It shall be possible to address and indicate the target UE using MSISDN addresses. This is FFS in later releases. 

7 Signaling Protocols and Interfaces 

7.1 Signalling protocols for LCS support in UMTS 
7.1.1 Protocol layering 

The Iu protocol stacks are defined in TS 25.410. The functions performed by each protocol layer are described in 
reference [1]. 

7.2 Iu interface 

The Iu interface is used to communicate between the LCS functional entities in the Core Network and the LCS entities 
in the Access Network. 

This interface passes the location requests and responses from authenticated external and internal LCS applications 
between the LCS entities in the Core Network and the Access Network LCS entities. Support for LCS signaling over Iu 
is specified in TS 25.413 RANAP signalling [14]. 

7.2.1 Core network location request 

The core network request for a location estimate of a target MS shall contain sufficient information to enable location of 
the Target UE according to the required QoS using any positioning method supported by the PLMN and, where 
necessary, UE. For location services the core network may request the geographical co-ordinates of the Target UE. The 
core network may also request in which Service Area the Target UE is located. The Service Area information may be 
used for routing of corresponding Emergency calls, or for CAMEL services and this corresponds to the usage of Cell ID 
in the core network of GSM. (The MSC shall not send the Service Area Identity to GMLC). 

It should be noted that the Service Area concept is different from the Localized Service Area concept used for SoLSA 
services. 

When the location of a Target UE in Idle Mode is requested, the core network shall determine which RNC is associated 
with the Target UE. 



7.2.2 Location Report 



The access network reports the location of the Target UE to the core network entities via the Iu interface. The location 
report may contain the following information as defined in the corresponding location request: 

the geographical co-ordinates of the Target UE; 

the service area in which the Target UE is located; 

achieved quality level of the location estimate; 
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7.3 Uu Interface 

The Uu interface is used to communicate among the LCS entities associated with the RNC, the UEs and the stand-alone 
Location Measurement Units (LMU). The Uu interface is also used to communicate between the LCS entities in the 
core network and the UE. 

This interface may pass measurement requests and results to and from UE or the stand-alone LMU. 

The Uu interface may also pass location requests from internal or external LCS Clients (Applications) at the UE. Note 
that these requests may require the services of the LCS entities associated with the core network to authenticate clients 
and subscriber subscriptions to aspects of the LCS. 

The Uu interface may also be used for broadcast of information that may be used by the UE or stand-alone LMU for 
their LCS operations. This may, for example, include timing and code information about nearby Node-B transmissions 
that may assist the UE or LMU in making their measurements. 

The Uu interface may also pass messages relating to changes or reporting of the data associated with the Location 
System Operations Function (LSOF) in the UE or the remote LMU. 

UTRAN Stage 2 specification 25.305 [1] specifies LCS signaling over the Uu interface. 

7.4 MAP Interfaces 

The MAP interfaces defined for GSM LCS should be re-used as much as possible in UMTS. 

There are two MAP interfaces in the UMTS Location Services: 

Interface between GMLC and HLR (Lh interface). 

This interface is used by the GMLC to request the address of the visited MSC or 3G-SGSN for a particular target UE 
whose location has been requested. 

- Interface between GMLC - MSC (Lg interface). 

This interface is used by the GMLC to convey a location request to the MSC currently serving a particular target UE 
whose location was requested. The interface is used by the MSC to return location results to the GMLC. 

The following MAP services are defined for GSM LCS and should be re-used for UMTS LCS: 

- MAP-SEND-ROUTING-INFO-FOR-LCS Service. 

This service is used between the GMLC and the HLR to retrieve the routing information needed for routing a location 
service request to the servicing 3G-VMSC. 

- MAP-PROVIDE-SUBSCRIBER-LOCATION Service. 

This service is used by a GMLC to request the location of a target UE from the visited MSC at any time. 

- MAP-SUBSCRIBER-LOCATION-REPORT Service. 

This service is used by a 3G-VMSC to provide the location of a target UE to a GMLC when a request for location is 
either implicitly administered or made at some earlier time. 
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8 General network location procedures 

8.1 State description for GMLC 
8.1.1 GMLC states 



8.1.1.1 



NULL State 



In the NULL state, a particular location request from some LCS client either has not been received yet or has already 
been completed. After a location request is received from a LCS client, the GMLC remains in the NULL state while the 
identity of the client and nature of its location request are verified. While the NULL state exists conceptually, it need 
not be represented explicitly in the GMLC. 



8.1.1.2 



INTERROGATION State 



In this state, the GMLC has sent an interrogation to the home HLR of the UE to be located and is awaiting a response 
giving the 3G-VMSC and/or 3G-SGSN address and IMSI for this UE. 



8.1.1.3 



LOCATION State 



In this state, the GMLC has sent a location request to the 3G-VMSC/3G-SGSN serving the UE to be located and is 
awaiting a response containing a location estimate. 

8.1.2 State functionality 
8.1.2.1 State Transitions 



Location Request - 

Interrogate HLR for 

VMSC address 





Receive 

Location 

or Timeout 

or Error 



Location Request - 

GMLC knows VMSC 

address 



Receive VMSC address 
from HLR 




Figure 8.1 : State Transitions in the GMLC 

Moving from NULL to INTERROGATION state: 

If the GMLC does not know the 3G-VMSC/3G-SGSN address or IMSI when it receives a location service request from 
some LCS client, it moves from the NULL state to the INTERROGATION state and sends a request to the UE's home 
HLR for the 3G-VMSC/3G-SGSN address and IMSI. 

Moving from NULL to LOCATION state: 
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If the GMLC already knows both the 3G-VMSC/3G-SGSN address and UE IMSI when it receives a location service 
request from some LCS client (e.g. from information retained for an earlier location request for the same UE), it moves 
from the NULL state to the LOCATION state and sends a location request to the 3G-VMSC/3G-SGSN. 

Moving from INTERROGATION to LOCATION state: 

After the GMLC, in the INTERROGATION state, receives the 3G-VMSC/3G-SGSN address and IMSI from the home 
HLR, it enters the LOCATION state and sends a location request to the 3G- VMSC of the UE being located. 

Moving from LOCATION to NULL state: 

After the GMLC receives a location estimate response from the 3G-VMSC/3G-SGSN, it forwards the location estimate 
to the requesting LCS client and re-enters the NULL state. 

8.1 .2.2 INTERROGATION Timer Function 

The GMLC runs a timer while in the INTERROGATION state to limit the amount of time waiting for an interrogation 
response from the HLR. If the timer expires before an interrogation response is received, the GMLC indicates a location 
failure to the LCS client and re-enters the NULL state. 

8.1 .2.3 LOCATION Timer Function 

The GMLC runs a timer while in the LOCATION state to limit the amount of time waiting for a location estimate 
response from the 3G-VMSC/3G-SGSN. If the timer expires before a response is received, the GMLC indicates a 
location failure to the LCS client and re-enters the NULL state. 

8.2 State description for 3G-VMSC/VLR 

8.2.1 3G-VMSC States 

8.2.1.1 LCS IDLE State 

In this state, the 3G-VMSC location service is inactive for a particular UE. The UE may be known in the VLR (except 
for a USIM less or SIM less Emergency call or where the UE record has been cancelled or lost in the VLR), but there 
may not be an active Mobility Management or Radio Resource connection to the UE. 

8.2.1.2 LOCATION State 

In this state, the 3G-VMSC is awaiting a response from SRNC after requesting the location for a particular UE. In this 
state, a RRC and a Mobility Management connection and the LCS layer of the Connection Management connection to 
the target UE will be active - allowing the SRNC and UE to exchange positioning related messages for mobile based 
and mobile assisted position methods. 
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8.2.2 State Functionality 
8.2.2.1 State Transitions 



Request 
Location fro 
the SRNC 




Receive 
Location 
results from the 
SRNC or 
Timeout 



Transfer 

Positioning 

Messages 

Figure 8.2: State Transitions in the 3G-VMSC 

Moving from LCS IDLE to LOCATION state: 

After a request has been received to locate a particular UE and the UE subscription options have been verified, a 
location request is sent to the SRNC associated with the serving cell of the UE to be located: the 3G-VMSC then enters 
the LOCATION state. Before entering this state, the 3G-VMSC must have setup a Mobility Management connection to 
the UE if none was previously active. The mobile is paged and authenticated before positioning. 

Moving from LOCATION to LCS IDLE state: 

After the return of a location estimate result from SRNC, the 3G-VMSC shall re-enter IDLE state. 



8.2.2.2 



LOCATION Timer Function 



The 3G-VMSC runs a timer while in the LOCATION state to limit the amount of time waiting for a location response 
from the RNC. If the timer expires before such information is received, the 3G-VMSC indicates a location failure to the 
original requesting entity and re-enters IDLE state. 



8.3 



(void) 



8.4 State description for RNC in UTRAN 

The state description of RNC in UTRAN is specified in TS 25.305. 

8.5 lu Signaling Connection 

Before 3G-MSC can request location information of a Target UE from SRNC, an lu Signaling Connection must have 
been established between 3G-MSC and SRNC. The 3G-MSC sends a RANAP Location Reporting control message to 
the SRNC, SRNC determines the location of the target UE related to this lu Signalling Connection and sends a Location 
Report to 3G-MSC over the same lu Signalling Connection. 
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8.6 General Network Positioning Procedures 

The generic network positioning procedure of providing the location information of an UE subscriber can be partitioned 
into the following procedures: 

Location Preparation Procedure 

This generic procedure is concerned with verifying the privacy restrictions of the UE subscriber, reserving network 
resources, communicating with the UE to be located and determining the positioning method to be used for locating the 
UE subscriber based on the requested QoS and the UE and network capabilities. 

Positioning Measurement Establishment Procedure 

This procedure is concerned with performing measurements by involving the necessary network and/or UE resources. 
Depending on the positioning method to be used for locating the UE the internals of this procedure can be positioning 
method dependent. The procedure is completed with the end of the positioning measurements. 

Location Calculation and Release Procedure 

This generic procedure is initiated after the measurements are completed and is concerned with calculating the location 
of the UE and releasing all network and/or UE resources involved in the positioning. 

8.7 Mobile Terminating Location Request 

[Editorial note: The GPRS specification TS 23.060 requires periodical UE position reporting (GSM Phase 1 allows 
only a single response to one query). The MT signaling flows below should be enhanced to show 
"multiple responses to one query". It should be noted that the connection may be closed down between 
responses.] 

8.7.1 Circuit Switched Mobile Terminating Location Request 
(CS-MT-LR) 

Figure 8.4 illustrates general network positioning for LCS clients external to the PLMN. In this scenario, it is assumed 
that the target UE is identified using either an MSISDN or IMSI. 
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Figure 8.4: General Network Positioning for a MT-LR 



Location Preparation Procedure 



(1) An external LCS client requests the current location of a target UE from a GMLC. The GMLC verifies the 
identity of the LCS client and its subscription to the LCS service requested and derives the MSISDN or IMSI of 
the target UE to be located and the LCS QoS from either subscription data or data supplied by the LCS client. 
For a call related location request, the GMLC obtains and authenticates the called party number of the LCS 
client [(refer to Annex A for further details)]. If location is required for more than one UE, or if periodic 
location is requested, steps 2 to 12 below may be repeated. 

(2) If the GMLC already knows both the 3G-VMSC location and IMSI for the particular MSISDN (e.g. from a 
previous location request), this step and step 3 may be skipped. Otherwise, the GMLC sends a 
MAP_SEND_ROUTING_INFO_FOR_LCS message to the home HLR of the target UE to be located with 
either the IMSI or MSISDN of this UE. 

(3) The HLR verifies that the calling party SCCP address of the GMLC corresponds to a known UMTS network 
element that is authorized to request UE location information. The HLR then returns the current 3G-VMSC 
address and whichever of the IMSI and MSISDN was not provided in step (2) for the particular UE. 
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(4) The GMLC sends a MAP_PROVIDE_ SUBSCRIBER .LOCATION message to the 3G-MSC indicated by the 
HLR. This message carries the type of location information requested (e.g. current location), the UE 
subscriber's IMSI, LCS QoS information (e.g. accuracy, response time) and an indication of whether the LCS 
client has the override capability. For a call related location request, the message also carries the LCS client's 
called party number. For a value added LCS client, the message shall carry the client name if available and, for 
a call unrelated location request, the identity of the LCS client. In other cases, inclusion of the client name 
and/or identity is optional. 

(5) If the GMLC is located in another PLMN or another country, the 3G- VMSC first authenticates that a location 
request is allowed from this PLMN or from this country. If not, an error response is returned. The 3G-VMSC 
then verifies LCS barring restrictions in the UE user's subscription profile in the VLR. In verifying the barring 
restrictions, barring of the whole location request is assumed if any part of it is barred or any requisite condition 
is not satisfied. If LCS is to be barred without notifying the target UE and a LCS client accessing a GMLC in 
the same country does not have the override capability, an error response is returned to the GMLC. Otherwise, 
if the UE is in idle mode, the Core Network performs paging, authentication and ciphering. If the target UE 
supports any UE based or UE assisted positioning method(s), the UE will also provide the SRNC and MSC with 
the positioning method(s) it supports via controlled early classmark sending. If the UE is instead in dedicated 
mode, the VMSC will already have any early classmark information. 

[GSM LCS: If the target UE has an established circuit call other than speech, the location request may be 
denied and an error response is then returned to the GMLC. If the location request is allowed for a non-speech 
circuit call, it shall be up to the SRNC to decide, on the basis of the applicable position methods and requested 
QoS, whether positioning is possible, [this is FFS]] 

(6) If the location request comes from a value added LCS client and the UE subscription profile indicates that the 
UE must either be notified or notified with privacy verification and the UE supports notification of LCS 
(according to the UE Classmark 2), an LCS Location Notification Invoke message is sent to the target UE 
indicating the type of location request (e.g. current location) and the identity of the LCS client and whether 
privacy verification is required. For a call related location request, the LCS client identity shall be set to the 
LCS client's called party number if no separate LCS client identity was received from the GMLC. Optionally, 
the VMSC may after sending the LCS Location Notification Invoke message continue in parallel the location 
process, i.e. continue to step 8 without waiting for a LCS Location Notification Return Result message in step 
7. 

(7) The target UE notifies the UE user of the location request. If privacy verification was requested, the target UE 
indicates to the UE user whether the location request will be allowed or not allowed in the absence of a 
response and waits for the user to grant or withhold permission. The UE then returns an LCS Location 
Notification Return Result to the 3G-VMSC indicating, if privacy verification was requested, whether 
permission is granted or denied. Optionally, the LCS Location Notification Return Result message can be 
returned some time after step 6, but before step 1 1 . If the UE user does not respond after a predetermined time 
period, the VMSC shall infer a "no response" condition. The 3G-VMSC shall return an error response to the 
GMLC if privacy verification was requested and either the UE user denies permission or there is no response 
with the UE subscription profile indicating barring of the location request in the absence of a response. 

(8) The 3G-MSC sends a RANAP Reporting Control message to the SRNC. This message includes the type of 
location information requested, the UE's location capabilities and requested QoS. 

8.7.1 .2 Positioning Measurement Establishment Procedure 

(9) If the requested location information and the location accuracy within the QoS can be satisfied based on cell 
coverage, cell ID and, if available, RTT value, the SRNC may send a RANAP Location Report immediately. 
Otherwise, the SRNC determines the positioning method and instigates the particular message sequence for this 
method, as specified in UTRAN Stage 2 [1], If the position method returns position measurements, the SRNC 
uses them to compute a location estimate. If there has been a failure to obtain position measurements, the SRNC 
may use the current cell information and, if available, RTT value to derive an approximate location estimate. If 
the UE returns an already computed location estimate to SRNC using an UE based position method, the SRNC 
may verify consistency with the current cell and, if available, RTT value. If the location estimate so obtained 
does not satisfy the requested accuracy or the location attempt failed, e.g. due to missing data, and sufficient 
response time still remains, the SRNC may instigate a further location attempt using the same (e.g. providing 
more assistance data to UE) or a different position method. If a vertical location co-ordinate is requested but the 
SRNC can only obtain horizontal co-ordinates, these may be returned. 
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In case IPDL is used the SRNC may send a massage to the BS/Node B to configure the power cease period of 
the Node Bs involved in the positioning process. However, if the IPDL alignment is specified in lower layers 
e.g. layer 1 then the functional split of IPDL processing may partly included in network elements functionality. 

8.7.1 .3 Location Calculation and Release Procedure 

(10) When a location estimate best satisfying the requested QoS has been obtained, the SRNC returns it to the 3G- 
MSC in a Location Report message. If a location estimate could not be obtained, the SRNC returns a Location 
Report message containing a failure cause and no location estimate. 

(ll)The 3G-MSC returns the location information and its age to the GMLC, if the VMSC has not initiated the 

Privacy Verification process in step 6. If step 6 has been performed for privacy verification, the VMSC returns 
the location information only, if it has received a LCS Location Notification Return Result indicating that 
permission is granted. If a LCS Location Notification Return Result message indicating that permission is not 
granted is received, or there is no response, with the UE subscription profile indicating barring of location in the 
absence of a response, the VMSC shall return an error response to the GMLC. If the SRNC did not return a 
successful location estimate, but the privacy checks in steps 6-7 were successfully executed, the 3G-VMSC may 
return the last known location of the target UE if this is known and the LCS client is requesting the current or 
last known location. The VLR may then release the Mobility Management connection to the UE, if the UE was 
previously idle, and the 3G-MSC may record billing information. 

(12) The GMLC returns the UE location estimate to the requesting LCS client. If the LCS client requires it, the 
GMLC may first transform the universal location co-ordinates provided by the 3G-MSC into some local 
geographic system. The GMLC may record billing for both the LCS client and inter-network revenue charges 
from the 3G-MSC's network. 

8.7.1a MT-LR without HLR Query - applicable to North America Emergency 
Calls only 

Figure 8.4a illustrates location for a North American Emergency Services call, where an emergency services client 
identifies the target UE using an IMSI, MSISDN or NA-ESRK plus, possibly IMEI, that were previously provided to it 
by the VMSC. The emergency services client also identifies the VMSC to the GMLC by providing an NA-ESRD or 
NA-ESRK or by referring to information for the target UE already stored in the GMLC. This allows the GMLC to 
request location from the VMSC without first querying the home HLR of the target UE. This is necessary when the 
home HLR either cannot be identified (e.g. client provides an NA-ESRK but not IMSI or MSISDN) or does not support 
the LCS query procedure. 
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UE 



4. Messages for individual positioning methods 



Figure 8.4a: Positioning for a Emergency Services MT-LR without HLR Query 

1) Same as step 1 in figure 8.4 but with the LCS client identifying first the target UE by an IMSI, MSISDN or NA- 
ESRK and possibly IMEI and, second, the VMSC by an NA-ESRK or NA-ESRD. 

2) If the GMLC already has stored information for the target UE (e.g. from a prior location estimate delivery to the 
LCS client), the GMLC may determine the VMSC from this information. Otherwise, the GMLC determines the 
VMSC using the NA-ESRK or NA-ESRD - with use of the NA-ESRK taking priority over that of the NA- 
ESRD. The MAP_PROVIDE_SUBSCRIBER_LOCATION message sent to the VMSC carries the IMSI, if 
available or MSISDN and, if provided, the IMEI for the target UE, as well as the required QoS and an indication 
of a location request from an emergency services client. The VMSC identifies the target UE using the IMSI or 
MSISDN and, if provided, the IMEI. 

3) The MSC verifies that UE privacy is overridden by the emergency services provider and that positioning is not 
prevented for other reasons (e.g. unreachable UE, inapplicable call type to the UE). The VMSC then sends a 
Location Request to the RAN, as for a normal MT-LR. 

4) RAN performs positioning as for a normal MT-LR. 

5) RAN returns a location estimate to the VMSC as for a normal MT-LR. 

6) Same as steps 1-5 for a normal MT-LR. 

7) Same as steps 1-6 for a normal MT-LR. 

8.7.2 MT-LR and PS-MT-LR for a previously obtained location estimate 

Every time the location estimate of a target UE subscriber is returned by the SRNC to the 3G-VMSC or 3G-SGSN, the 
3G-VMSC or 3G-SGSN may store the location estimate together with a time stamp. The 3G-MSC may store this 
information in the subscriber's VLR record. 

The time stamp is the time at which the location estimate is stored at the VLR or 3G-SGSN i.e. after the SRNC returns 
the location estimate to the 3G-VMSC or 3G-SGSN. The time stamp indicates the "age" of the location estimate. 
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8.7.2.1 Initial Location 

In the context of an originating emergency call the location estimate and the associated time stamp at the 
commencement of the call set-up is referred to as "initial location". 

8.7.2.2 Current Location 

After a location attempt has successfully delivered a location estimate and its associated time stamp, the location 
estimate and time stamp is referred to as the "current location " at that point in time. 

8.7.2.3 Last known Location 

The current location estimate and its associated time stamp are stored in MSC/VLR or 3G-SGSN and until replaced by 
a later location estimate and a new time stamp is referred to as the "last known location". The last known location may 
be distinct from the initial location - i.e. more recent. 

8.7.2.4 Security and Privacy 

The handling of security and privacy of the target UE with regard to returning the last known or initial location estimate 
of the target UE shall be the same as when the target UE is reachable for positioning, (i.e. the requesting LCS client is 
authorized and the privacy of the target UE is secured before the 3G-VMSC check the VLR status of the target UE (i.e. 
whether the UE is marked as attached or detached in the VLR) or the 3G-SGSN checks the status of the target UE. 

8.7.2.5 Failing to locate the target UE 

In case of a "Detached" or "Not Reachable" target UE, the last known location and a time stamp stored at the VLR or 
3G-SGSN, may be returned to a LCS client requesting location information if the LCS client specifically requested the 
current or last known location. This does not apply to a value added LCS client where the target UE subscribes to 
notification of the location request: if the notification cannot be performed, the 3G-VMSC or 3G-SGSN shall reject the 
location request. 

NOTE: Due to CAMEL, the 3G-MSC/VLR may already be storing other location information parameters like 
location number, service area identity and VLR number in the subscriber's VLR record. 

When a request for location information is received at the 3G-VMSC or 3G-SGSN, the request shall indicate whether 
the "last known location of the target UE" should be returned in case of a "detached" or "not reachable" target UE. 

If the VLR or 3G-SGSN has a valid copy of the subscriber's permanent data and the target UE's privacy settings are 
such that positioning is allowed, then the following two cases can occur. 

8.7.2.5.1 Target UE is "Not Reachable" 

If the target UE is marked as "attached" in the VLR or 3G-SGSN, the 3G-VMSC or 3G-SGSN orders paging of the 
target UE. If paging fails, due to target UE being "not reachable" then 3G-VMSC or 3G-SGSN shall check whether the 
LCS client has requested "last known location" in case of "not reachable" target UE. 

If such a request exists and notification to the target UE does not apply for a value added LCS client, the 3G-VMSC or 
3G-SGSN shall include the last known location together with the time stamp available in its response to the request for 
location information. 

An indicator of "last known location" returned shall be marked at the CDR at 3G-VMSC or 3G-SGSN. 

8.7.2.5.2 Target UE is "Detached" 

If the target UE is marked as "detached" in the VLR or 3G-SGSN, the 3G-VMSC or 3G-SGSN shall check whether the 
LCS client has requested "last known location" in case of "detached" target UE. 

If such a request exists and notification to the target UE does not apply for a value added LCS client, the 3G-VMSC or 
3G-SGSN includes the "last known location" together with the time stamp available in its response to the request for 
location information. 

An indicator of "last known location" returned shall be marked at the CDR at 3G-VMSC or 3G-SGSN. 
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8.7.2.5.3 



Target UE is Reachable but Positioning Fails 



If the target UE is reachable (e.g. paging succeeds), but the VMSC or 3G-SGSN is unable to obtain a current location 
estimate, the VMSC or 3G-SGSN shall check whether the LCS client has requested "last known location". 

If such a request exists and notification to the target UE either does not apply or was successfully executed for a value 
added LCS client, the VMSC or 3G-SGSN includes the "last known location" together with the time stamp available in 
its response to the request for location information. 

8.7.2.5.4 An indicator of "last known location" returned shall be marked at the CDR at 

VMSC or 3G-SGSN.Target UE is "Purged" 

If the target UE is marked as "Purged" in HLR, then an indication "Absent Subscriber" is returned to the GMLC. 

8.7.3 Network Induced Location Request (NI-LR) 

Figure 8.5 illustrates positioning for an emergency service call. 
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Figure 8.5: Positioning for a NI-LR Emergency Service Call 



8.7.3.1 



Location Preparation Procedure 



1) An initially idle UE requests RRC setup (RACH) Service Request indicating a request for an Emergency Service 
call to the 3G- VMSC via the SRNC. 
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2) The SRNC shall convey the CM service request across the Iu-interface. (Before having a CM connection there 
must be a RRC connection.) The UE may identify itself using a TMSI, IMSI or IMEI. 

3) The emergency call procedure is applied. 

4) The 3G-VMSC, SRNC and UE continue the normal procedure for emergency call origination towards the 
appropriate emergency services client. Depending on local regulatory requirements, the sending of call setup 
information into the PSTN may be delayed until either the UE's location has been obtained or the location 
attempt has failed or a PLMN defined timer has expired before location was obtained. Call setup information 
sent into the PSTN may include the UE location (if already obtained) plus information that will enable the 
emergency service provider to request UE location at a later time (e.g. NA-ESRD and NA-ESRK in North 
America). 

5) At any time after step 1 and after sufficient time has been allowed to enable completion of early classmark 
sending to the SRNC and MSC where the UE supports any UE assisted or UE based positioning method(s), the 
3G-VMSC may initiate procedures to obtain the UE's location. These procedures may run either in parallel with 
the emergency call origination or while emergency call origination is suspended to delay sending of call setup 
information into the PSTN according to step 3. The 3G-VMSC sends a RANAP Location Request message to 
the SRNC associated with the UE's current location area (see step 8 for a MT-LR). This message includes 
indication about the UE's location capabilities, and the QoS required for an emergency call. 

8.7.3.2 Positioning Measurement Establishment Procedure 

6) The actions described under step 9 for a MT-LR are performed. If a speech compatible traffic channel is 
established, the same traffic channel may be used for both the positioning and the emergency call. In that case, 
the traffic channel may be allocated by either the positioning procedure or emergency call origination procedure. 

8.7.3.3 Location Calculation and Release Procedure 

7) When a location estimate best satisfying the requested QoS has been obtained, the SRNC returns it to the 3G- 
VMSC. 

8) Depending on local regulatory requirements, the 3G-VMSC may send a MAP Subscriber Location report to a 
GMLC associated with the emergency services provider to which the emergency call has been or will be sent. 
This message shall carry any location estimate returned in step 7, the age of this estimate and may carry the 
MSISDN, IMSI and IMEI of the calling UE. In North America, any NA-ESRD and any NA-ESRK that may 
have been assigned by the 3G-VMSC shall be included. The message shall also indicate the event that triggered 
the location report. If location failed (i.e. an error result was returned by the SRNC in step 7), an indication of 
failure rather than a location estimate may be sent to the GMLC: the indication of failure is conveyed by not 
including a location estimate in the MAP Subscriber Location Report. 

9) The GMLC acknowledges receipt of the location information. For a North American Emergency Services call, 
the GMLC shall store the location information for later retrieval by the emergency services LCS client. 

10) The GMLC may optionally forward the information received in step 8 to the emergency services LCS client. For 
a North American emergency services call the client is expected to obtain the location information by requesting 
it from the GMLC. 

1 1) At some later time, the emergency services call is released. 

12)For a North American Emergency Services call, the 3G-MSC sends another MAP Subscriber Location Report to 
the GMLC. This message may include the same parameters as before except that there is no position estimate 
and an indication of emergency call termination is included. 

13) The GMLC acknowledges the 3G-MSC notification and may then release all information previously stored for 
the emergency call. 
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8.7.4 Network Induced Location Request (NI-LR and PS-NI-LR) from a 
Serving RNC for a target UE in dedicated mode 

Figure 8.6 illustrates how a serving RNC may obtain the location of a target UE that is already in dedicated mode 1 ' on 
behalf of some PLMN operator LCS client - e.g. to support handover. The procedure is valid for SRNC when local 
regulatory requirements do not require privacy checking for PLMN operator initiated location. The procedure is valid in 
PS and CS modes. 

1) "Dedicated mode" is defined in TS 25.331. 
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Figure 8.6: Network Induced Location Request from a Serving RNC 

8.7.4.1 Location Preparation Procedure 

1) A LCS client within the SRNC requests the current location of a target UE from the SRNC. 

8.7.4.2 Positioning Measurement Establishment Procedure 

2) Refer to step 9 for a MT-LR or step 10 in PS-MT-LR. 

8.7.4.3 Location Calculation and Release Procedure 

3) The SRNC returns the UE location estimate to the requesting LCS client. 

8.7.5 (void) 



8.8 Mobile Originating Location Request 

8.8.1 Mobile Originating Location Request, Circuit Switched (CS-MO-LR) 

The following procedure shown in Figure 8.8 allows an UE to request either its own location, location assistance data or 
broadcast assistance data message ciphering keys from the network. Location assistance data may be used subsequently 
by the UE to compute its own location throughout an extended interval using a mobile based position method. The 
ciphering key enables the UE to decipher other location assistance data broadcast periodically by the network. The 
MO-LR after location update request may be used to request ciphering keys or GPS assistance data using the follow-on 
procedure described in TS 24.008. The procedure may also be used to enable an UE to request that its own location be 
sent to an external LCS client. 
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Figure 8.8:General Network Positioning for MO-LR 



8.8.1.1 



Location Preparation Procedure 



1) If the UE is in idle mode, the UE requests an RACH and sends a CM service request indicating a request for a 
call independent supplementary services to the 3G-VMSC via the SRNC. 

2) The SRNC shall convey the CM service request across the Iu-interface. If the UE is in dedicated mode, the UE 
sends a CM Service Request on the already established RACH. 

3) The 3G- VMSC instigates authentication and ciphering if the UE was in idle mode or returns a Direct Transfer 
CM Service Accept if the UE was in dedicated mode. If the target UE supports any UE based or UE assisted 
positioning method(s), the UE will provide the SRNC and 3G-MSC with the positioning method(s) it supports 
via controlled early classmark sending. 

4) The UE sends a LCS MO-LR Location Services invoke to the 3G-VMSC Different types of location services 
can be requested: location of the UE, location of the UE to be sent to an external LCS client, location assistance 
data or broadcast assistance data message ciphering keys. If the UE is requesting its own location or that its own 
location be sent to an external LCS client, this message carries LCS requested QoS information (e.g. accuracy, 
response time). If the UE is requesting that its location be sent to an external LCS client, the message shall 
include the identity of the LCS client and may include the address of the GMLC through which the LCS client 
should be accessed. If a GMLC address is not included, the 3G-VMSC may assign a GMLC address stored in 
the 3G-VMSC. If a GMLC address is not available for this case, the 3G-VMSC shall reject the location request. 
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If the UE is instead requesting location assistance data or ciphering keys, the message specifies the type of 
assistance data or deciphering keys and the positioning method for which the assistance data or ciphering 
applies. The 3G-VMSC verifies in the UE's subscription profile that the UE has permission to request its own 
location, request that its location be sent to an external LCS client or request location assistance data or 
deciphering keys (whichever applies). If the UE is requesting positioning and has an established call, the 3G- 
VMSC may reject the request for certain non-speech call types. 

5) The 3G-VMSC sends a RANAP Location Reporting Control message to the SRNC associated with the Target 
UE. The RANAP message indicates whether a location estimate or location assistance data is requested and 
includes the UE's location capabilities. If the UE's location is requested, the message also includes the requested 
QoS. If location assistance data is requested, the message carries the requested types of location assistance data. 

8.8.1 .2 Positioning Measurement Establishment Procedure 

6) If the UE is requesting its own location, the actions described under step 9 for a MT-LR are performed. If the UE 
is instead requesting location assistance data, the SRNC transfers this data to the UE as described in subsequent 
sections. The SRNC determines the exact location assistance data to transfer according to the type of data 
specified by the UE, the UE location capabilities and the current cell. 

8.8.1 .3 Location Calculation and Release Procedure 

7) When a location estimate best satisfying the requested QoS has been obtained or when the requested location 
assistance data has been transferred to the UE, the SRNC returns a RANAP Location Report to the 3G-VMSC. 
This message carries the location estimate or ciphering keys if this was obtained. If a location estimate or 
deciphering keys were not successfully obtained or if the requested location assistance data could not be 
transferred successfully to the UE, a failure cause is included in the Location Report. 

8) If the UE requested transfer of its location to an external LCS client and a location estimate was successfully 
obtained, the 3G-VMSC shall send a MAP Subscriber Location Report to the GMLC obtained in step 4 carrying 
the MSISDN of the UE, the identity of the LCS client, the event causing the location estimate (MO-LR) and the 
location estimate and its age. 

9) The GMLC shall acknowledge receipt of the location estimate provided that is serves the identified LCS client 
and the client is accessible. 

10) The GMLC transfers the location information to the LCS client. 

1 l)The 3G-VMSC returns an LCS MO-LR Return Result to the UE carrying any location estimate requested by the 
UE, ciphering keys or a confirmation that a location estimate was successfully transferred to the GMLC serving 
an LCS client. 

12) The 3G-VMSC may release the CM, MM and RRC connections to the UE, if the UE was previously idle, and 
the 3G-VMSC may record billing information. 

8.8.2 (void) 

8.9 LCS signaling procedures specified in UTRAN Stage 2, 
TS 35.305 

The following signaling procedures are specified in UTRAN LCS Stage 2, reference [1]: 

1) Common Procedures to Support Positioning. These procedures are: 

Information Transfer between SRNC and a Target UE 
LCS Information Transfer between SRNC and other RNCs 

2) Common Procedures to Support Access to an LMU: 

The information transfer between SRNC and an LMU associated with Node B 
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The information transfer between SRNC and a standalone LMU 

3) Common Control Procedures for LMUs: 

The LMU Reset Procedure 
LMU Status Query Procedure 
LMU Status Update Procedures 

4) LCS signaling interactions between SRNC and other RNCs. 



8.10 Exception Procedures 



The procedures in this subclause apply to all variants of an MT-LR, NI-LR and MO-LR where a RANAP Location 
reporting control message has been sent to an SRNC requesting some location service (e.g. provision of a location 
estimate for a target UE or transfer of assistance data to a target UE). 

8.1 0.1 Procedures in the VMSC 

After the VMSC has requested a location service for a particular UE from the SRNC, certain events may occur that may 
temporarily or permanently interfere with the location service attempt. For each such event notified to the VMSC, the 
VMSC shall employ one of the following error recovery actions. 

Restart the Location Service 

This action shall be employed for any event that temporarily impedes a location service attempt and cannot be delayed 
until the location service attempt is complete. When such an event is notified to the 3G-VMSC, it shall immediately 
cancel the location service attempt and the associated RANAP dialogue with SRNC, if this still exists by releasing all 
resources specifically allocated for the location attempt and ignoring the location attempt response when received. 

After aborting the location request dialogue with the SRNC, the 3G-VMSC may queue the location service request until 
the event causing the restart has terminated (if not already terminated). The 3G-VMSC may optionally wait for an 
additional time period (e.g. if the queuing delay is minimal) to ensure that any resources allocated in and by the SRNC 
have time to be released. The 3G-VMSC may then send another location service request to the SRNC associated with 
the target UE. 

Abort the Location Service 

This action shall be employed for any event that permanently impedes a location service attempt, such as loss of the 
dedicated signaling channel to the target MS. When such an event is notified to the 3G-VMSC, it shall cancel the 
current location service attempt and the associated RANAP dialogue with the SRNC, if still existing, by releasing all 
resources specifically allocated for the location attempt and ignoring the location attempt response when received. The 
3G-VMSC shall then return an error response to the client or network entity from which the location request was 
originally received. 

The following table indicates the appropriate error recovery procedure for certain events. For events not listed in the 
table, the 3G-VMSC need take no action. 

Table 8.1 : LCS Error Recovery Procedures in the VMSC for certain Events 



Event 


VMSC Error Recovery 


Release of radio channel to the UE 


Abort 


Any error response from the SRNC, except for inter-SRNC or inter- 
MSC handover 


Abort 


Inter RNC hard handovers, SRNC relocation, inter- MSC 
handovers and InterSystem handovers 


Abort on lu level 

Restart after process is completed 



If the RNC is in an overload condition, it may reject a location request by indicating congestion. The MSC may reduce 
the frequency of future location service requests until rejection due to overload has ceased. 
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8.10.2 Handover handling 

In case of hard handovers, e.g. inter RNC hard handover, or Serving RNC relocation, and inter- MSC handovers, the 
ongoing positioning process is aborted on Iu level. In soft handovers where the Serving RNS and Iu are relocated, any 
ongoing positioning process is also aborted on Iu level. The VMSC shall restart the Iu aborted location requests with the 
new Serving RNC. During intra and inter RNC soft and softer handovers where there is no SRNS relocation the existing 
RRC connection can normally be used without any need to abort the on-going positioning process on Iu level. 

8.1 0.2.1 MSC procedure for Inter-MSC handover 

When a location estimate is required for a target UE with an established call in a state of inter-MSC handover, the 
serving location area ID shall be used by the visited MSC to identify the correct SRNC to serve the location request. All 
location request related messages shall be sent via MAP/E interface piggy-backed in 

MAP_FORWARD_ACCESS_SIGNALLING and MAP PROCESS_ACCESS_SIGNALLING between the visited and 
serving MSCs. 

8.10.2.2 Handling of an ongoing handover while a request for positioning arrives 

If during an ongoing handover procedure a request for location information arrives, the request shall be suspended until 
the handover is completed. On completion of the handover, the location preparation procedure shall continue. 

8.11 Privacy 

8.1 1 .1 Privacy Override Indicator (POI) 

The POI is used to determine whether the privacy settings of the subscriber to be positioned shall be overridden by the 
request for location services. The assignment of a POI value with an "override" or "not override" value in the LCS 
client profile is done during the LCS client provisioning. The type of LCS client requesting location information (i.e. 
emergency, law-enforcement etc.) shall determine the value of the POI assigned to the LCS client profile. 

There are two distinct cases regarding the handling of the privacy override indicator. 

Procedure A: If the subscriber to be positioned is in the same country as the GMLC then the POI shall override the 
subscriber's privacy options, as allowed by regulatory requirements. 

Procedure B: Otherwise the POI shall not override the subscriber's privacy options. 

8.1 1 .2 Privacy Procedures 

The SLPP shall contain the privacy options defined in the HLR of the UE subscriber. 

The SLPP shall be downloaded to the VMSC together with the rest of his subscription information in the existing MAP 
operation INSERT_SUBSCRIBER_DATA. It will be deleted with the existing MAP operation 
DELETE_SUBSCRIBER_DATA. 

The POI is transferred from the GMLC to the VMSC in the location request. Based on the location of the GMLC the 
VMSC evaluates whether to accept or ignore the received POI according to the definition in subclause 8.1 1.3. 

If the POI is accepted the location requested is unconditionally performed. Otherwise if the POI is ignored the VMSC 
evaluates the privacy options in the UE subscriber's subscription profile (assuming this is held in the VLR). If the VLR 
does not contain the UE subscription profile, LCS will rely on the existing GSM recovery mechanisms to obtain the 
profile. 

Note: If more than one privacy class are subscribed for the UE, the privacy class for an MT-LR is selected according 
to the rule described in the informative ANNEX A. 

If the location request is allowed by the privacy options the location request is performed. Otherwise, if the location 
request is barred by the privacy options, the location request is refused an error response is returned to the GMLC with 
a cause code indicating that the request was rejected by the subscriber. 
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8.11.3 UE Privacy Options 

The UE privacy options in the SLPP apply to an MT-LR or NI-LR and either indicate that no MT-LR or NI-LR is 
allowed for the UE (except as may be overridden by the POI or local regulatory requirements) or define the particular 
classes of LCS client for which an MT-LR or NI-LR for location are allowed, with the following classes being possible: 

a) Universal Class - allow positioning by all LCS clients 

b) Call related Class - comprises any LCS client to which the UE originated a call that is currently established. For 
all clients in the call related class, one of the following subscription options shall apply: 

positioning allowed without notifying the UE user (default case) 

positioning allowed with notification to the UE user 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user 

c) Non-Call related Class - allow positioning by specific identified LCS Clients or groups of LCS Client with the 
following restrictions allowed for each identified LCS Client or group of LCS Clients 

Location request allowed only from GMLCs identified in the SLPP 

Location request allowed only from a GMLC in the home country 

Location request allowed from any GMLC (default case) 

For each identified value added LCS client in the privacy exception list, one of the following subscription 
options shall apply: 

positioning allowed without notifying the UE user (default case) 

positioning allowed with notification to the UE user 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user 

For all value added LCS clients sending a non-call related MT-LR that are not identified in the privacy exception 
list, one of the following subscription option shall apply: 

positioning not allowed (default case) 

positioning allowed with notification to the UE user 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user 

d) PLMN operator Class - allow positioning by specific types of client within or associated with the VPLMN, with 
the following types of client identified: 

clients providing a location related broadcast service 

- O&M client in the HPLMN (when the UE is currently being served by the HPLMN) 

- O&M client in the VPLMN 

Clients recording anonymous location information without any UE identifier 
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Clients enhancing or supporting any supplementary service, IN service, bearer service or teleservice 
subscribed to by the target UE subscriber 

If the UE subscribes to the universal class, any MT-LR or NI-LR shall be allowed by the VMSC. If local regulatory 
requirements mandate it, any MT-LR for an emergency services LCS client and any NI-LR for an emergency services 
call origination shall be allowed by the VMSC. 

If the UE subscribes to the call-related class, an MT-LR may be allowed if the UE previously originated a call that is 
still established and the called party number dialled by the UE matches the called party number received from the 
GMLC. If the called party number conditions are satisfied, the MT-LR shall be allowed if the UE user subscribes to 
either location without notification or location with notification. If the UE user subscribes to location with notification 
and privacy verification, the MT-LR shall be allowed following notification to the UE if the UE user either returns a 
response indicating that location is allowed or returns no response but subscribes to allowing location in the absence of 
a response. In all other cases, the MT-LR shall be restricted. 

If the UE subscribes to the non-call related class, an MT-LR may be allowed by the network if the identity of the LCS 
client or LCS client group supplied by the GMLC matches the identity of any LCS Client or LCS Client group 
contained in the UE's SLPP and any other GMLC restrictions associated with this LCS Client identity in the SLPP are 
also met. 

If the LCS client is correctly matched in this way and any GMLC restrictions are satisfied, the MT-LR shall be allowed 
if the UE user subscribes to either location without notification or location with notification. If the UE user subscribes 
to location with notification and privacy verification, the MT-LR shall be allowed following notification to the UE if the 
UE user either returns a response indicating that location is allowed or returns no response but subscribes to location in 
the absence of a response. In all other cases, the MT-LR shall be restricted. 

If the UE subscribes to the non-call related class, an MT-LR from an LCS client that is not contained in the UE's SLPP 
shall allowed or restricted according to the following conditions. For any non-matched LCS client, the MT-LR shall be 
allowed if the UE user subscribes to location with notification. If the UE user subscribes to location with notification 
and privacy verification, the MT-LR shall be allowed following notification to the UE if the UE user either returns a 
response indicating that location is allowed or returns no response but subscribes to location in the absence of a 
response. In all other cases, the MT-LR shall be restricted. 

If the UE subscribes to the PLMN class, an NI-LR or MT-LR shall be allowed if the client within the VPLMN, for an 
NI-LR, or the client identified by the GMLC, for an MT-LR, either matches a generic type of client contained in the 
UE's SLPP or is otherwise authorized by local regulatory requirements to locate the UE. 

Note: If more than one privacy class are subscribed for the UE, the privacy class for an MT-LR is selected according 
to the rule described in the informative ANNEX A. 

In evaluating privacy where any address "A" associated with the LCS client (e.g. LCS client ID or GMLC address) 
needs to be compared with a corresponding address "B" in the target UE's SLPP, a match shall be determined if a match 
is found for each of the following components of each address: 

a) Numbering Plan 

b) Nature of Address Indicator 

c) Corresponding address digits for all digits in "B" (the digits or initial digits in "A" must match all the digits in 
"B", but "A" may contain additional digits beyond those in "B") 

All addresses shall be transferred to the MSC/VLR in international format, except for the called party number received 
from the GMLC during a Call Related MT-LR when the LCS client was reached via IN or abbreviated number routing 
(e.g. toll free number or emergency call routing). In these cases it is up to the GMLC to use the valid national specific 
number of the visited country. 
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8.12 Mobile Originating Location 

An UE may subscribe to any of the following classes of mobile originating location: 

A) Basic Self Location 

B) Autonomous Self Location 

C) Transfer to Third Party 

An MO-LR shall be allowed by the VMSC if the type of request is supported by the appropriate subscription according 
to the following table. 

Table 8.2: Required UE Subscription Options for MO-LR Requests 



Type of MO-LR Request 


Required UE Subscription 


UE requests own location 


Basic Self Location 


UE requests location assistance data 


Autonomous Self Location 


UE requests transfer of own location to another LCS Client 


Transfer to Third Party 



8.13 CM Procedures 

8.13.1 Location request for a mobile in idle-mode 

When a request for location information is received at the VMSC the LCS -layer shall order paging of the UE 
subscriber. In case of first unsuccessful paging, normal paging procedures should apply. After successful paging the 
LCS -layer shall invoke the location preparation procedure. 

8.1 3.2 Location request for a mobile in dedicated-mode 

When a request for location information is received at the VMSC, if the UE is already busy on CM level, the LCS -layer 
shall attempt to establish a parallel transaction to the existing one. If successful, the LCS-layer shall invoke the location 
preparation procedure. 



9 Information storage 

This clause describes information storage structures that are mandatory (M), conditional (C) or optional (O) for LCS, 
and the recovery and restoration procedures needed to maintain service if inconsistencies in databases occur and for lost 
or invalid database information. Information storage in SRNC and LMU is specified in UTRAN Stage 2, reference [1]. 

9.1 HLR 

The HLR holds LCS data for both UE subscribers and LMUs. 

9.1 .1 LCS Data in the HLR for an UE Subscriber 

The IMSI is the primary key for LCS UE subscription data in the HLR. This subscription data may be stored in a 
Multiple Subscriber Profile (MSP), with the HLR able to hold a number of MSPs per IMSI. 

LCS UE subscription data includes a privacy exception list containing the privacy classes for which location of the 
target UE is permitted. Each privacy class is treated as a distinct supplementary service with its own supplementary 
service code. The following logical states are applicable to each privacy class (refer to GSM 23.01 1 for an explanation 
of the notation): 
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Table 9.1 : Logical States for each LCS Privacy Class 



Provisioning State 


Registration State 


Activation State 


HLR Induction State 


(Not Provisioned, 


Not Applicable, 


Not Active, 


Not Induced) 


(Provisioned, 


Not Applicable, 


Active and Operative, 


Not Induced) 



For each LCS privacy class, the HLR shall store the logical state of the class on a per-subscriber (or per subscriber 
MSP) basis. In addition, the permanent data indicated below shall be stored on a per subscriber (or per subscriber MSP) 
basis when the logical provisioning state of the associated LCS privacy class is "provisioned". For the meaning of each 
LCS privacy class, refer to clause 8 and to TS 22.071. 



Table 9.2: LCS data stored in the HLR privacy exception list for an UE Subscriber (or UE Subscriber 

MSP) 



LCS Privacy Class 


Status 


Additional HLR Data when Class is provisioned 


Universal Class 


- 


No additional data 


Call Related Class 


M 


Indication of one of the following mutually exclusive options: 

• Location allowed without notification (default case) 

• Location allowed with notification 

• Location with notification and privacy verification; location 
allowed if no response 

• Location with notification and privacy verification; location 
restricted if no response 


Call Unrelated Class 


M 

O 
C 



c 


Indication of one of the following mutually exclusive options for any LCS 
client not in the external LCS client list: 

• Location not allowed (default case) 

• Location allowed with notification 

• Location with notification and privacy verification; location 
allowed if no response 

• Location with notification and privacy verification; location 
restricted if no response 

External LCS client list: a list of zero or more LCS clients, with the 
following data stored for each LCS client in the list: 

• International E.1 64 address identifying a single LCS client or a 
single group of LCS clients that are permitted to locate this 
target UE 

• Restriction on the GMLC. Possible values are: 

identified GMLCs only 

Any GMLC in the home country 

• Indication of one of the following mutually exclusive options: 

Location allowed without notification (default case) 

Location allowed with notification 

Location with notification and privacy verification; location 

allowed if no response 

Location with notification and privacy verification; location 

restricted if no response 


PLMN Operator Class 





LCS client list: a list of one or more generic classes of LCS client that 
are allowed to locate the particular UE. The following classes are 
distinguished: 

• LCS client broadcasting location related information 

• O&M LCS client in the HPLMN 

• O&M LCS client in the VPLMN 

• LCS client recording anonymous location information 

• LCS Client supporting a bearer service, teleservice or 
supplementary service to the target UE 



LCS UE subscription data may include a mobile originating list containing the LCS mobile originating classes that an 
UE is permitted to request. Each LCS mobile originating class is treated as a distinct supplementary service with its 
own supplementary service code. The following logical states are applicable to each mobile originating class (refer to 
TS23.01 1 for an explanation of the notation): 
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Table 9.3: Logical States for each Mobile Originating LCS Class 



Provisioning State 


Registration State 


Activation State 


HLR Induction State 


(Not Provisioned, 


Not Applicable, 


Not Active, 


Not Induced) 


(Provisioned, 


Not Applicable, 


Active and Operative, 


Not Induced) 



For each LCS Mobile Originating class, the HLR shall store the logical state of the class on a per-subscriber (or per 
subscriber MSP) basis. In this version of LCS, there is no additional permanent data in the HLR. The table below shows 
the defined mobile originating classes. For the meaning of each LCS mobile originating class, refer to clause 8 and to 
GSM 22.071. 

Table 9.4: Data stored in the HLR for the LCS Mobile Originating List for an UE (or UE Subscriber 

MSP) 



LCS Mobile Originating 
Class 


Status 


Additional HLR Data when Class is provisioned 


Basic Self Location 


- 


No additional data 


Autonomous Self Location 


- 


No additional data 


Transfer to Third Party 


- 


No additional data 



In addition to the privacy exception list, the following other data iteUE may be stored in the UE subscription profile in 
the HLR to support LCS: 

Table 9.5: Temporary LCS data in the HLR 



Other Data in the HLR 


Status 


Description 


GMLC List 


O 


List of one or more E.164 addresses of the GMLCs from which a 
location request for an MT-LR is allowed, The addresses are only 
relevant to an LCS client that is restricted (in the UE privacy exception 
list) to making call unrelated location requests. 
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9.2 



VLR 



The VLR contains the same LCS permanent data for each registered UE subscriber, as does the HLR. This data is 
downloaded to the VLR as part of the location update procedure between the VLR and HLR for an UE subscriber. 



9.3 



GMLC 



The GMLC holds data for a set of external LCS clients that may make call related or non-call related MT-LR requests 
to this GMLC. The permanent data administered for each LCS client is as follows. 

Table 9.6: GMLC Permanent Data for a LCS Client 



LCS Client data in GMLC 


Status 


Description 


LCS Client Type 


M 


Identifies the type LCS client from among the following: 

• Emergency Services 

• Value Added Services 

• PLMN Operator Services 

• - Lawful Intercept Services 


External identity 


M 


A list of one or more identifiers used to identify an external LCS client 
when making an MT-LR - the nature and content of the identifier(s) is 
outside the scope of the present document 


Authentication data 


M 


Data employed to authenticate the identity of an LCS client - details are 
outside the scope of the present document 


Call related identity 


O 


A list of one or more international E.164 addresses to identify the client 
for a call related MT-LR. 

In case the LCS client was reached via IN or abbreviated number routing 
(e.g. toll free number or emergency call routing), the E.1 64 number(s) 
stored in the GMLC shall be the number(s) that the UE has to dial to 
reach the LCS Client. In these cases the E.1 64 number is not to be in 
international format. The country in which the national specific number(s) 
is (are) applicable is (are) also stored (or implied) in this case. 
Each call related identity may be associated with a specific external 
identity 


Non-call related identity 


O 


A list of one ore more international E.164 addresses to identify the client 

for a non-call related MT-LR. 

Each non-call related identity may be associated with a specific external 

identity 


Override capability 





Indication of whether the LCS client possesses the override capability 
(not applicable to a value added client) 


Authorized UE List 





A list of MSISDNs or groups of MSISDN for which the LCS client may 
issue a non-call related MT-LR. Separate lists of MSISDNs and groups of 
MSISDN may be associated with each distinct external or non-call related 
client identity. 


Priority 


M 


The priority of the LCS client - to be treated as either the default priority 
when priority is not negotiated between the LCS server and client or the 
highest allowed priority when priority is negotiated 


QoS parameters 


M 


The default QoS requirements for the LCS client, comprising: 

• Accuracy 

• Response time 

Separate default QoS parameters may be maintained for each distinct 
LCS client identity (external, non-call related, call related) 


Allowed LCS Request Types 


M 


Indicates which of the following are allowed: 

• Non-call related MT-LR 

• Call related MT-LR 

• Specification or negotiation of priority 

• Specification or negotiation of QoS parameters 

• Request of current location 

• Request of current or last known location 


Local Co-ordinate System 


O 


Definition of the co-ordinate system(s) in which a location estimate shall 
be provided - details are outside the scope of the present document 


Access Barring List(s) 


O 


List(s) of MSISDNs or groups of MSISDN for which a location request is 
barred 
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9.4 Recovery and Restoration Procedures 

The LCS recovery and restoration procedures allow temporary data to be recovered or reinitialized following loss or 
corruption of data, such that normal LCS service is rapidly restored and inconsistency between the data held by 
different LCS network elements is removed. For a full description, refer to TS 23.007. 



1 Operational Aspects 

10.1 Charging 

Charging Information collected by the PLMN serving the LCS Client. 

The following charging information shall be collected by the PLMN serving the LCS Client: 

Type and Identity of the LCS Client; 

Identity of the target UE; 

Results (e.g. success/failure, method used if known, response time, accuracy) - to be repeated for each instance 
of positioning for a deferred location request; 

- Identity of the visited PLMN; 

- LCS request type (i.e. LDR or LIR); 

- State; 

Event (applicable to LDR requests only); 

Time Stamp; 

Type of co-ordinate system used. 

10.2 Charging Information Collected by the Visited PLMN 

The following charging information shall be collected by the visited PLMN: 

Date and time; 

Type and Identity of the LCS Client (if known) 

Identity of the target UE; 

Location of the target UE (e.g., MSC, location area ID, cell ID, location co-ordinates); 

Which location services were requested; 

Results (e.g. success/failure, positioning method used, response time, accuracy) - to be repeated for each instance 
of positioning for a batch location request; 

- Identity of the GMLC or PLMN serving the LCS Client; 

- State; 

Event (applicable to LDR requests only). 
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Annex A (informative): 
Privacy class selection rule 



If more than one privacy class are subscribed for the UE, the privacy class for an MT-LR is selected according to the 
following flow diagram. 




Yes 



PLMN Operator 
class 



Call Related 
class 



Yes 



The location request is not 
allowed unconditionally 



Call Unrelated 
class 



The location request is not 
allowed unconditionally 



Figure A.1 : Privacy Class selection flow diagram 



Note 1 : 
Note 2: 



Note 3: 



The client type indicates PLMN Operator service, and the client is within or associated with the VPLMN. 
The client type indicates value added service; the UE originated call to the requesting LCS client is 
established and the address associated to the LCS client used by the UE call set up matches with that 
contained in the location request. 
The client type indicates value added service. 
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Annex B (informative); 
Change history 



Date 


New Version 


Comment 


March 2000 


3.0.0 


Output from SA#7. Minor editorial changes compared to v.2.0.0 


July 2000 


3.1.0 


Output from SA#8. The main change is the deletion of all the PS related material 

(will be re-introduced in LCS R00 in 23.271) 

CR implemented: 

001 r1 : Ensure reliable privacy verification for value added LCS MT-LR 

002r1 : Adding "hooks" indications in UMTS LCS stage 2, Removing PS LCS 

signaling procedures from R99 23.171 . Note: the CR was mentioning that "Text 

marked within { brackets } is intended for releases later than Release 99." : this text 

has not been incorporated. 

All the text marked within { brackets } has been deleted (not applicable to R99). 


December 2000 


3.2.0 


Incorporation of CR 005 on adding a chapter "MT-LR without HLR Query - 
applicable to North America Emergency Calls only" to 23.171 


March 2001 


3.3.0 


Incorporation of the following CRs, approved at SA#1 1 : 
CR015 "Service Area Definition in LCS stage2", 
CR016 "Stop reporting procedure for UMTS" and 
CR01 7 "Privacy check procedure for call related MT-LR" 


June 2001 


3.4.0 


Incorporation of the following CR, approved at SA#12: 
CR 018r1 "LCS location notification messages" 


October 2001 


3.5.0 


Incorporation of the following CR, approved at SA#13: 
CR 019r1 " Applicability of Privacy Override Indicator" 


December 2001 


3.6.0 


Incorporation of the following CR, approved at SA#14: 
CR020 "Wrong node name in privacy check procedures" 
CR021 "Exception procedures in the VMSC" 


March 2002 


3.7.0 


Incorporation of the following CR, approved at SA#15: 
CR023M Correction of information flows LCS client - GMLC 
CR024M Removal of NA-ESRK from MT-LR request for North American 
Emergency call 


June 2002 


3.8.0 


Incorporation of the following CR, approved at SA#16 
CR025r2 Clarification of CS-MO-LR procedures 


September 2002 


3.9.0 


Incorporation of the following CR, approved at SA#17: 
CR026M Privacy class selection flow diagram 


June 2003 


3.10.0 


Incorporation of the following CR, approved at SA#20: 
CR029r2 Exception procedures in 23.171 
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